02a27915cebc58e41c056c9ad5cc3813fd76faff48b338b1be82427cb52ccd05

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
Size

68KB
MD5

aaf9e142eca338d65cc308d6cc98b1f0
SHA1

de7c1add21acaa2886fdbcdb3bce441a722aeee2
SHA256

02a27915cebc58e41c056c9ad5cc3813fd76faff48b338b1be82427cb52ccd05
SHA512

6a0fec007ae25919ec69f654af5258131dc815923b25c77eb51d469fe0a6d983f5195f674f56965b61c8e8fe67e626b16defa937f410638d8569fad165b05f81
SSDEEP

1536:r1BvK2hM46fGBCzSfNNI6yx8Hoh3eypmrYbwWof:r1BvK7pmCzSlNILr7mrlf

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2648	BCSSync.exe
2744	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2916	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
2916	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
2648	BCSSync.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2648 set thread context of 2744	2648	BCSSync.exe	33

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2916	2028	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2648	2916	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2648	2916	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2648	2916	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2648	2916	aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe	32
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2648 wrote to memory of 2744	2648	BCSSync.exe	33
PID 2744 wrote to memory of 2640	2744	BCSSync.exe	34
PID 2744 wrote to memory of 2640	2744	BCSSync.exe	34
PID 2744 wrote to memory of 2640	2744	BCSSync.exe	34
PID 2744 wrote to memory of 2640	2744	BCSSync.exe	34

C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\aaf9e142eca338d65cc308d6cc98b1f0_JaffaCakes118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
68KB

MD5
40104f4c6e590d844930eef6f6ddf5e1

SHA1
a94abdb39d12f9776751993bbf552b1cdfa8c86d

SHA256
bd573ec462e0a90e293894a5ce925da7294de991eb84ec942704f4bfb00e9623

SHA512
6aa6acb88cac90bfd91a8f976b473fccf9861a77970dcab559c163d2d3767180cdf00cc602c4730d5a39f87355ef8afefd0b8ff39a4e9dc84e64a833074a3ceb

Download Submit
memory/2744-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2916-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download